public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
From: "Gerd Hoffmann" <kraxel@redhat.com>
To: Laszlo Ersek <lersek@redhat.com>
Cc: devel@edk2.groups.io, oliver@redhat.com,
	 Jiewen Yao <jiewen.yao@intel.com>,
	Ard Biesheuvel <ardb+tianocore@kernel.org>
Subject: Re: [edk2-devel] [PATCH 1/1] OvmfPkg/VirtNorFlashDxe: fix shadowbuffer reads
Date: Fri, 12 Jan 2024 12:26:11 +0100	[thread overview]
Message-ID: <r5jttbe57w7iclbhkznv2rloxyufhwcjvxdm2n47ftwvnm6umx@3sdcekz4cmii> (raw)
In-Reply-To: <0ccd39db-ce5c-e7c7-192e-d67f939b5dad@redhat.com>

On Fri, Jan 12, 2024 at 10:47:43AM +0100, Laszlo Ersek wrote:
> On 1/11/24 14:36, Gerd Hoffmann wrote:
> > In some cases (specifically when the flash update region is
> > small but crosses a multiple of P30_MAX_BUFFER_SIZE_IN_BYTES)
> > NorFlashWriteSingleBlock reads only one instead of two
> > P30_MAX_BUFFER_SIZE_IN_BYTES blocks into the shadow buffer.
> > 
> > That leads to random crap being written to the second block,
> > which in turn can corrupt both the variable store and the
> > FTW work space.
> > 
> > This patch fixes the calculation.
> > 
> > Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> > ---
> >  OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
> > index 1afd60ce66eb..cdc809d75e3d 100644
> > --- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
> > +++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
> > @@ -566,7 +566,7 @@ NorFlashWriteSingleBlock (
> >                 Instance,
> >                 Lba,
> >                 Offset & ~BOUNDARY_OF_32_WORDS,
> > -               (*NumBytes | BOUNDARY_OF_32_WORDS) + 1,
> > +               (((Offset & BOUNDARY_OF_32_WORDS) + *NumBytes) | BOUNDARY_OF_32_WORDS) + 1,
> >                 Instance->ShadowBuffer
> >                 );
> >      if (EFI_ERROR (Status)) {
> 
> This patch looks like the output of an excellent bug analysis. I'll need
> more time to review this. If you have a ticket with the analysis
> captured (actual numbers, debugging logs, a concrete backtrace / call
> chain triggering the issue, etc), I'd appreciate a reference.

Yea, that was a few days browsing through the flash and Ftw code,
sprinkling in debug logging, learning how all this works.  Have a shell
script resetting a VM in a loop with slowly increasing delay, to trigger
the code paths recovering from interrupted flash writes.

Finding 0xaf (aka PcdDebugClearMemoryValue) in not-yet used places of
the ftw log (which should have been 0xff) was the bit of information
which finally made me find the root cause of the flash corruption.

I have some followup patches I'll send out as patch series in a moment,
one of them adds variables here to make the whole logic easier to
understand.

stay tuned & take care,
  Gerd



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#113711): https://edk2.groups.io/g/devel/message/113711
Mute This Topic: https://groups.io/mt/103661868/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-



      reply	other threads:[~2024-01-12 11:26 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-01-11 13:36 [edk2-devel] [PATCH 1/1] OvmfPkg/VirtNorFlashDxe: fix shadowbuffer reads Gerd Hoffmann
2024-01-12  9:47 ` Laszlo Ersek
2024-01-12 11:26   ` Gerd Hoffmann [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-list from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=r5jttbe57w7iclbhkznv2rloxyufhwcjvxdm2n47ftwvnm6umx@3sdcekz4cmii \
    --to=devel@edk2.groups.io \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox